A lot of people don’t like to store credentials in mobile apps or browsers. A good workaround is the usage of OAuth 2.0 tokens, but the application needs to support it and the server you’re talking to too. The IBM Connections Mobile App can use it for authentication.
OAauth2 can be used directly with WebSphere Application Server and Connections 6.0. There are no special OAuth servers or applications needed!
The Documentation at IBM was a little bit confusing for me, there are lots of sidenotes, but you just need to do following steps, to use OAuth 2.0 token-based authentication with the IBM Connections Mobile App.
== Register Client
Open wsadmin and add the client identifier for the mobile app:
cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin ./wsadmin.sh -lang jython -username was-user -password password execfile('oauthAdmin.py') OAuthApplicationRegistrationService.addApplication("connections_social_mobile", "Connections Mobile", "com.ibm.ibmscp://com.ibm.mobile.connections/token")
/opt/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/cellName/oauth20/! Set the following value to
<parameter name="oauth20.allow.public.clients" type="cc" customizable="true"> <value>true</value> </parameter>
- Default is false here!
Now the OAuth Provider needs to be recreated (start command in
./wsadmin.sh -lang jython -conntype SOAP -c "print AdminTask.createOAuthProvider('[-providerName connectionsProvider -fileName /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/nameCell01/oauth20/connectionsProvider.xml]')" -username wasadmin -password password
wsadmin.bat -lang jython -conntype SOAP -c "print AdminTask.createOAuthProvider('[-providerName connectionsProvider -fileName d:/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/nameCell01/oauth20/connectionsProvider.xml]')" -username wasadmin -password password
The Documentation tells you to restart all Application Servers now. I would wait until you finished the
Enable OAuth in
... <!-- SECURITY SETTINGS SECTION --> <SecuritySettings enabled="true"> <AuthType>OAuth</AuthType> ... <OAuthAuthorizationURL>https://yourcnx-webserver-name/oauth2/endpoint/connectionsProvider/authorize</OAuthAuthorizationURL> <OAuthTokenURL>https://yourcnx-webserver-name/oauth2/endpoint/connectionsProvider/token</OAuthTokenURL> <OAuthClientId>connections_social_mobile</OAuthClientId> ...
Change <AuthType/> to this line
Change <OAuthAuthorizationURL/> to this line, change your CNX Hostname
Change <OAuthTokenURL/> to this line, change your CNX Hostname
Just as an information this name was used in the registration command in the first steps (Default)
When you sync the nodes and restart your application servers, the setting is immediately activated! So users already use the Connections Mobile app (with saved credentials) are logged out and need to reauthenticate in the web form for OAuth!
Mobile Client configuration
When you add your server to the mobile app, you get the login screen of your Connections environment after providing the server hostname:
Now the user needs to Grant the Access to the system.
I tested in a VPN environment and got messages that no profile can be found for my credentials, but reload always showed the content. I think this needs to be tested a little bit more!